With having completed the early access testing on our new EDRv3 capabilities and with the upcoming features that will be entering the New Endpoint and Server Protection and EDR Features early access program being more protection rather than EDR related, we plan to change the license that customers receive on enrolling in those EAPs and that license will no longer include EDR capabilities.
When do we expect to make this change?
We plan on making this change the weekend of the 31st of October.
How can I get detail on what features are coming and what features are currently in the New Endpoint and Server Protection and EDR Features early access program?
The 'New Endpoint/Server Protection and EDR Features Early Access Program' blog post provides details on the current features in the early access program and is modified as new features are added.
What does this mean for customers who are participating in these early access programs?
Customers participating in these early access programs who don’t have an EDR entitlement will lose access to all EDR capabilities including Live Discover, Live Response plus all older EDR capabilities (Threat Search, Threat Indicators, Admin Isolation etc). Depending on the endpoint version and components customers may be prompted to reboot these devices. Customer’s looking for better control around changes to their devices over the weekend of October 31st can opt to leave the EAPs at a time that suits them better. Leaving the EAP will also results in the removal and change in versions of components.
From testing we have seen that customers with the current Endpoint or Server Intercept X Advanced licensed software will see that the Live Discover software is removed from all devices (regardless of whether they were in the EAP or not). No reboot is requested.
From testing we’ve seen nothing will change for customers participating in these early access programs who are running the current Intercept X Advanced with EDR licensed software for endpoints and/or servers (whether in the EAP or not). No software is removed and no reboots are requested.
What if a customer is interested in EDR capabilities and would still like to test them?
Central customers who have endpoint and/or server licenses but don’t have an EDR entitlement who want to test or continue to test EDR capabilities can start an in product trial in Sophos Central by selecting ‘Free Trials’ in the left-hand menu and choosing the ‘Intercept X Advanced with EDR’ or ‘Intercept X Advanced for Server with EDR’ trials.